<html>
<head><meta charset="utf-8"><title>VaList · t-lang/wg-unsafe-code-guidelines · Zulip Chat Archive</title></head>
<h2>Stream: <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/index.html">t-lang/wg-unsafe-code-guidelines</a></h2>
<h3>Topic: <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/VaList.html">VaList</a></h3>

<hr>

<base href="https://rust-lang.zulipchat.com">

<head><link href="https://rust-lang.github.io/zulip_archive/style.css" rel="stylesheet"></head>

<a name="156612996"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/VaList/near/156612996" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> dlrobertson <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/VaList.html#156612996">(Jan 22 2019 at 15:26)</a>:</h4>
<p>I'm working on implementing C variadics in Rust (RFC 2137) which are SUPER unsafe (CWE-134 and CWE-234). Is there anything I should do related to this WG?  Are C variadics and VaList worth a active discussion topic?</p>



<a name="156613061"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/VaList/near/156613061" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> dlrobertson <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/VaList.html#156613061">(Jan 22 2019 at 15:27)</a>:</h4>
<p>I kind of get the feeling that <code>va_list</code> in Rust will kind of be a niche thing, so I'm a little uncertain that it is worth the energy</p>



<a name="156613167"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/VaList/near/156613167" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> dlrobertson <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/VaList.html#156613167">(Jan 22 2019 at 15:29)</a>:</h4>
<p>But I'd also really hate for the unsafety of it to go undocumented</p>



<a name="156613410"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/VaList/near/156613410" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> dlrobertson <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/VaList.html#156613410">(Jan 22 2019 at 15:32)</a>:</h4>
<p>If it is something worth discussing, just ping me. I'd be happy to dump my current research/thoughts in an issue/PR</p>



<a name="156613422"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/VaList/near/156613422" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/VaList.html#156613422">(Jan 22 2019 at 15:32)</a>:</h4>
<p>the goal of UCG is not to document all unsafety, libraries can and will continue to add their own</p>



<a name="156613468"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/VaList/near/156613468" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/VaList.html#156613468">(Jan 22 2019 at 15:33)</a>:</h4>
<p>but in general interaction with platform-specific "stuff" is in scope here</p>



<a name="156613535"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/VaList/near/156613535" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/VaList.html#156613535">(Jan 22 2019 at 15:34)</a>:</h4>
<p>for VaList I guess the main question is whether there are far-reaching consequences or whether it's "just" a lot of local complexity when actually writing a vaarg fn</p>



<a name="156613762"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/VaList/near/156613762" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/VaList.html#156613762">(Jan 22 2019 at 15:36)</a>:</h4>
<p>feel free to open an issue at <a href="https://github.com/rust-rfcs/unsafe-code-guidelines/issues" target="_blank" title="https://github.com/rust-rfcs/unsafe-code-guidelines/issues">https://github.com/rust-rfcs/unsafe-code-guidelines/issues</a> -- this does sound like something that people will be asking about eventually^^</p>



<a name="156613904"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/VaList/near/156613904" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> dlrobertson <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/VaList.html#156613904">(Jan 22 2019 at 15:38)</a>:</h4>
<p>The gist of the unsafty is that there is no guarantee that the caller has input the same type or number of args as the callee expects, so depending on how it is used there can be far reaching consequences a la string formatter vulns</p>



<a name="156614136"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/VaList/near/156614136" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> dlrobertson <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/VaList.html#156614136">(Jan 22 2019 at 15:41)</a>:</h4>
<p><span class="emoji emoji-1f44d" title="+1">:+1:</span> I'll try to collect some stuff and post it. If after reading it, it seems to be outside fo the scope of this WG feel free to close it</p>



<a name="156614188"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/VaList/near/156614188" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> dlrobertson <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/VaList.html#156614188">(Jan 22 2019 at 15:42)</a>:</h4>
<p>IMO there are probably more important areas to focus on first e.g. unions</p>



<a name="156614891"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/VaList/near/156614891" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/VaList.html#156614891">(Jan 22 2019 at 15:50)</a>:</h4>
<blockquote>
<p>The gist of the unsafty is that there is no guarantee that the caller has input the same type or number of args as the callee expects, so depending on how it is used there can be far reaching consequences a la string formatter vulns</p>
</blockquote>
<p>that's not what I meant by far-reaching. I meant things like memory-mapped I/O, which might have consequences in general discussions about references -- things with a "global effect". of course any local unsafety can "become" global if something goes wrong when forwarding the safety obligations.</p>



<a name="156614966"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/VaList/near/156614966" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/VaList.html#156614966">(Jan 22 2019 at 15:51)</a>:</h4>
<p>string format vulns arise because <code>printf</code> is NOT a safe API, it would be an unsafe function in Rust with some obligations for the callers. that's still "local" in the sense that only the two sides of this unsafe contract have to care -- if one of them screws up, all is lost, but that's a separate issue (and trued pretty much all the time)</p>



<a name="156615127"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/VaList/near/156615127" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> dlrobertson <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/VaList.html#156615127">(Jan 22 2019 at 15:53)</a>:</h4>
<blockquote>
<p>that's not what I meant by far-reaching</p>
</blockquote>
<p>Ah, sorry about that</p>



<a name="156615215"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/VaList/near/156615215" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/VaList.html#156615215">(Jan 22 2019 at 15:54)</a>:</h4>
<p>no need to be sorry, I am probably making up my own vocabulary here ;)</p>



<a name="156615235"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/VaList/near/156615235" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> dlrobertson <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/VaList.html#156615235">(Jan 22 2019 at 15:55)</a>:</h4>
<p>I think I see what you're getting at</p>



<a name="156615359"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/VaList/near/156615359" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/VaList.html#156615359">(Jan 22 2019 at 15:57)</a>:</h4>
<p><code>setjmp</code>/<code>longjmp</code> is also awfully far-reaching, to give another example</p>



<a name="156615528"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/VaList/near/156615528" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> dlrobertson <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/VaList.html#156615528">(Jan 22 2019 at 15:59)</a>:</h4>
<p>Under that definition of local I don't see global consequences... AFAIK most the <code>va_list</code> vulns arise out of one side not adhering to the contract</p>



<a name="156615692"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/VaList/near/156615692" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> dlrobertson <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/VaList.html#156615692">(Jan 22 2019 at 16:01)</a>:</h4>
<p>So the guidelines for <code>va_list</code> may be just "set clear rules and adhere to them"</p>



<a name="156616322"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/VaList/near/156616322" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/VaList.html#156616322">(Jan 22 2019 at 16:08)</a>:</h4>
<p>yes</p>



<a name="156616332"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/VaList/near/156616332" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/VaList.html#156616332">(Jan 22 2019 at 16:08)</a>:</h4>
<p>except "just" might be a misnomer here ;)</p>



<a name="156616862"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/VaList/near/156616862" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> dlrobertson <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/VaList.html#156616862">(Jan 22 2019 at 16:15)</a>:</h4>
<p>Ha! true</p>



<a name="156674484"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/VaList/near/156674484" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/VaList.html#156674484">(Jan 23 2019 at 09:16)</a>:</h4>
<p><span class="user-mention" data-user-id="143663">@dlrobertson</span> feel free to open an issue but: </p>
<blockquote>
<p>The gist of the unsafty is that there is no guarantee that the caller has input the same type or number of args as the callee expects</p>
</blockquote>
<p>I don't see much difference between this, and writing an <code>extern { }</code> function that has a different signature from the C code (e.g. C expects a pointer and the Rust signature has a e.g. <code>f32</code> ).</p>



<a name="156674580"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/VaList/near/156674580" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/VaList.html#156674580">(Jan 23 2019 at 09:18)</a>:</h4>
<p>Basically code that writes <code>unsafe { extern_fn(....) }</code> is claiming that the <code>extern_fn</code> signature is ok. When it comes to <code>va_args</code> it would just claim that the number and types of the arguments passed is also ok. If it isn't, then that code is at fault. </p>
<p>We have a lot of tools for verifying that claim.</p>



<hr><p>Last updated: Aug 07 2021 at 22:04 UTC</p>
</html>